felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): rewrite debconf & add debconf-frontend.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-18 23:31:03 +02:00
parent 390cc27ab8
commit 49155625a5
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
12 changed files with 92 additions and 224 deletions
Download patch file Download diff file Expand all files Collapse all files

49
apparmor.d/profiles-s-z/tasksel
View file

@ -10,32 +10,24 @@ include <tunables/global>
@{exec_path} = @{bin}/tasksel
profile tasksel @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/perl>
include <abstractions/common/debconf>
@{exec_path} r,
@{sh_path} rix,
@{bin}/tempfile rix,
@{lib}/tasksel/tasksel-debconf rix,
@{lib}/tasksel/tests/* rCx -> tasksel-tests,
# Think what to do about this (#FIXME#)
/usr/share/debconf/frontend rPx,
#/usr/share/debconf/frontend rCx -> frontend,
@{lib}/tasksel/tests/* Cx -> tasksel-tests,
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored.
@{bin}/dpkg-query rpx,
@{bin}/dpkg-query px,
#
@{bin}/apt-cache rPx,
@{bin}/apt-cache Px,
@{bin}/debconf-apt-progress Px,
@{bin}/debconf-apt-progress rPx,
/usr/share/tasksel/** r,
/usr/share/debconf/confmodule r,
/usr/share/tasksel/{,**} r,
owner @{tmp}/file* w,
@ -48,35 +40,6 @@ profile tasksel @{exec_path} flags=(complain) {
include if exists <local/tasksel_tasksel-tests>
}
profile frontend flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/perl>
include <abstractions/nameservice-strict>
/usr/share/debconf/frontend r,
@{bin}/tasksel rPx,
@{sh_path} rix,
@{bin}/stty rix,
@{bin}/locale rix,
# The following is needed when debconf uses dialog/whiptail frontend.
@{bin}/whiptail rPx,
owner @{tmp}/file* w,
/usr/share/debconf/confmodule r,
/etc/debconf.conf r,
owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk,
/usr/share/debconf/templates/adequate.templates r,
/etc/shadow r,
include if exists <local/tasksel_frontend>
}
include if exists <local/tasksel>
}

5
apparmor.d/profiles-s-z/update-secureboot-policy
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{sbin}/update-secureboot-policy
profile update-secureboot-policy @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/common/debconf>
@{exec_path} rm,
@ -23,12 +23,9 @@ profile update-secureboot-policy @{exec_path} {
@{bin}/sort rix,
@{bin}/touch rix,
@{bin}/wc rix,
/usr/share/debconf/frontend rPx,
/ r,
/usr/share/debconf/confmodule r,
/var/lib/dkms/ r,
/var/lib/shim-signed/dkms-list rw,